0

I've been made aware of the Zend Framework 1 Security Vulnerability.

I understand that an attack could happen and so I wanted to be secure.

We don't send mails directly from our magento server, we use Sendgrid integration.

Are we safe if we are not sending the mails directly?

Many thanks in advance.

  • Is Sendgrid using ZF? – Marius Jan 16 '17 at 15:43
0

As stated on the Magento Security Center, you should disable the function in any case as long as there is no available fix.

See: https://magento.com/security/news/new-zend-framework-1-security-vulnerability

  • Thanks, you are right. It does say to do this regardless of which email service being used. So I will do this as per magento's instruction. – BlamesJunt Jan 16 '17 at 15:58
0

You should talk to Sendgrid.

If you are using this module: https://github.com/yukoff/magento2-sendgrid-smtp, you still may be voulnerable. Looking at https://github.com/yukoff/magento2-sendgrid-smtp/blob/master/Model/Transport.php it looks like their module is leveraging the Magento native send() method which may be leveraging Sendmail if your system is using Sendmail.

/**
 * Send mail using this transport
 *
 * @return void
 * @throws \Magento\Framework\Exception\MailException
 */
public function sendMessage()
{
    try {
        parent::send($this->_message);
    } catch (\Exception $e) {
        throw new \Magento\Framework\Exception\MailException(new \Magento\Framework\Phrase($e->getMessage()), $e);
    }
}

So, to be safe, you should set "Set Return_Path" to No as directed by Magento.

  • Thank you for your more expansive answer. I could contact sendgrid, but I suspect their answer will not be conclusive and so I am going to play it safe and do as Magento suggest until this problem is patched. – BlamesJunt Jan 16 '17 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.